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ABSTRACT 

The lunar module autopilot is a first-generation digital 
control system design. The two torque sources available for the 
control function of the descent-stage configuration consist of 
16 reaction jets and a slow, gimbaled, throttlable engine. This 
case study includes a review of the design history, the design 
requirements, criteria, constraints, and general design philosophy 
of the control system development. Comparative f light- test results 
derived from design testing are presented. 


INTRODUCTION 

In the fall of 1964, a significant Apollo program decision 
was made; that is, to develop a digital autopilot (DAP) for all 
spacecraft primary control systems , It is noteworthy that pre- 
vious manned spacecraft designs (Mercury, Gemini) involved 
analog control system techniques; thus, the Apollo DAP represents 
a first-generation design development. This paper contains a 
case study of the design history of the lunar module (LM) primary 
control system. The LM DAP, with respect to design requirements 
and constraints, is considered to be the most complex Apollo con- 
trol system in use. Hence, significant original design concepts 
were necessarily required in the development process. 


The general purpose and motivation of this paper are to 
provide some insight into the problems encountered by the control 
system designer. In many ways, the so-called "gap" between con- 
trol system theory and practice is the result of a lack of 
appreciation of the severe/time and cost constraints under which 
the control system designer is required to produce his product. 

Reading this paper, one may wonder why <the total development 
has continued during a period of approximately 4 years; he may 
ask why the DAP should not be designed once and be finished. 

Most projects of this magnitude are iterative, because the 
requirements sometimes change radically, because the initial 
design constraints are generally poorly defined, because the 
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inherent characteristics of the spacecraft plant are not well 
known, and because the basic input data for control system 
design are frequently not available in a timely manner. It is 
important to realize that major design decisions must be made, 
rightly or wrongly, despite the lack of fundamental input infor- 
mation. Because of the basic factors that characteristically 
make the design task difficult, the designer must adopt an 
implicit or explicit philosophy of providing some degree of 
flexibility in the control design, so as to accommodate future 
contingencies or unexpected developmental problems. 

The concept of performance margin will be examined in a 
later section, but a point to be recognized now is that most 
papers on control theory emphasize obtaining optimum (or accept- 
able) performance for nominal situations, whereas in practice, 
the acceptability of the total design is most often determined 
by performance under extreme, off-nominal conditions. Generally, 
establishing explicit mathematical criteria for off-nominal per- 
formance is extremely difficult; therefore, the subjective judg- 
ment of the system designer (who uses significant simulation 
testing programs for design validation) is essential. 

A significant problem encountered in designing the DAP was 
the lack of effective analysis techniques for developing and 
evaluating the digital control system. The major design tools 
used were phase-plane simulation techniques in which tradeoffs 
and design constants were established by "cut-and-try" methods. 

A more colorful manner of expressing this approach is (1) "the 
[design] has been chosen on the basis of theoretical investigations 
and empirical observations." 


LIST OF ACRONYMS AND SYMBOLS 


ACRONYMS 

APS ascent propulsion system 

CDU coupling data unit 

CM command module 

CSM command and service module 

DAP digital autopilot 

DB deadband 

DPS descent propulsion system 

GTS gimbal trim system 

ICS interpretive computer simulators 

IMU inertial measurement unit 

LGC LM guidance computer 

LM lunar module 

PIPA pulsed integrating pendulous accelerometer 
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PRM 

RCS 

SM 

TJET 


SYMBOLS 

''os 
a,b, c 

B 

CDU 

E,E 

I 

I I 
yy Z 2 

K 

L 

M 

Mu,M^ 

[M] 

M 

Kc] 

N 


P,Q,R 

P,U,V 

T 

T 

c 

t 


u 


V 

W 


pulse-ratio modulation 
reaction control system 
service module 

time (duration) of jet firing 


= estimated offset angular acceleration 
= mass property parameters 
= intercept constant 
= coupling data unit angle 
= attitude and rate errors 
= I (M) pitch or roll moment of inertia 
= principal moments of inertia 
= filter weights 

= L(M) distance from hinge pin of descent 
engine bell to center of mass of LM 

= estimated mass 

applied torque 

- gimbal-to-pilot increment matrix 

= transformation from gimbal axes to pilot 
axes 

= transformation from pilot axes to control 
axes 

= noise 

- integer 

= number of sample periods 
= pilot axes 
= control axes 
= control sample period 
= thrust command 
= time 

= urgency functions 

= trim gimbal drive command (+1, 0, -1) 

= velocity 

= Kalman filter gains 
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Greek Letters 

a - angular acceleration 

g = lag angles 

Y = transforination angle 

between U/V and 
U ' /V ' axes 

ATq - steering sample period 

ATg = control sample period 

6 = gimbal drive rate of 

descent engine = 

0 . 2 deg/sec 

e = PRM attitude error 

6 = gimbal angle, attitude; 

u - angular velocity 


Subscripts 

C = cycle 

eg = center of mass 

d = desired angular velocity 

e = attitude error 

G = gimbaling 

I = inner gimbal angle 

i = index 

J about an axis from the 

firing of a single jet 

M = middle gimbal angle 

m — index 

n = index 

0 = outer gimbal angle 


Operators 

= estimate 

. = first time derivative 

** = second time derivative 

= measured value 
2 = summation 

DESIGN CONSIDERATIONS 
Vehicle Characteristics 

The DAP provides Stabilization and control of the LM during 
both coasting and’ powered flight in three eonf iguratiorts — descent 
(Figure 1), ascent (Figure 2), and docked with the command and 
service module (CSM) as shown in Figure 3; During 'bhe preliminary 
spacecraft-design phase, many fundamental decisions were made 
that define (and constrain) the control system design. For the 
LM, three basic propulsion force and torque systems were estab- 
lished — reaction control system (RCS) , descent propulsion 
system (DPS) , and ascent propulsion system (APS) . Characteristics 
that influenced the control task included the type of actuation 
system, the geometrical location and number of thrusters or jets 
(for redundancy), and the type of thrust-variation system. 

The control options available to the systems designer are 
divided into various flight-mode categories (Table I) . The RCS 
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Figure 3. The CSM-docked configuration of the LM 

provides automatic/manual rotation and small translation control 
for all LM configurations during coasting flight. During coasting 
flight, the design problem is characterized by the presence of 
extremely low disturbance torques (except for an RCS jet-on 
failure) . 

During APS-powered flight, the primary purpose of the RCS 
is to provide attitude stabilization and control. However, when- 
ever feasible, it is a design requirement to fire only the 
upward-thrusting RCS jets to obtain AV in the desired direction. 
Because the APS is a non-gimbaled, fixed- throttle system, the 
RCS control laws associated with this mode must accommodate large 
time-variant disturbance torques. 

During DPS-powered flight, the design provides yaw control 
with the RCS jets, and pitch/roll attitude control with a com- 
bination of the RCS and the gimbal trim system (GTS) , The design 
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TABLE I 


CHARACTERISTICS OF SPACECRAFT PROPULSION FORCES AND MOMENTS 


Propulsion 

force/moment 

Vehicle 

configuration 

Characteristics 

Control 

function 

Reaction con- 
trol system 

LM descent, 
LM ascent, 
LM/CSM 

16 jets mounted 
in 4 quads 45 
deg off Y/Z 
body axes center- 
line . Nominal 
force of 100 lb. , 
arm length of 
5.5 ft. 

P-, U-, V-axis 
control for 
all configura- 
tions 

Descent 

propulsion 

system 

! 

LM descent, 
LM/CSM 

Throttable 
engine (1,050 
to 10,500 lb.) 
with slow-speed 
gimbal actua- I 

tors in Q-, R- 
axes 

Q- , R-axis 
control for 
both con- 
figurations 

Ascent 

propulsion 

system 

LM ascent 

Constant- thrust 
engine (3,500 
lb.) fixed with 
respect to space- 
craft 

None 


problems associated with dual control, including interactions 
between RCS and GTS modes, were significant for the DAP. As pre- 
viously mentioned, the geometrical location of the RCS jets is 
significant in establishing the fundamental design approach. The 
locations of the RCS jets are shown in Figure 4. The eight 
X-axis RCS jets inherently provide control about the U/V axes, 
where the natural axes to consider phase-plane logic design are 
the Q/R pilot (or body) axes. The descent engine (not shown) is 
gimbaled about the pitch (Q) and roll (R) axes. 

An important parameter not shown in Figure 4 is the distance 
from the spacecraft center of mass to the geometric center of the 
16 RCS jets. This equivalent arm length is dependent upon both 
configuration and propellant loading, and strongly influences the 
ability to translate in the Y or Z direction. 

Sensor Characteristics 

The sensor information available for the control-design pro- 
blem is provided by an inertial platform called the inertial 


- 7 - 










Pitch axis 




Jets associated with RCS fuel system A 
(jets 2, 4, 5, 8, 10, 11, 13, and 15) 
Jets associated with RCS fuel system B 
(jets 1, 3, 6, 7, 9, 12, 14, and 16) 


Notes 

1. The arrows indicate thrust direction. 

2. The P, Q, and R designations for the pilot axes and the 
P, U, and V designations for the control axes are used 

in connection with rotation. The X, Y, and Z designation 
are used in connection with translation. 

Figure 4. - Locations of RCS jets on LM 

measurement unit (IMU) . For attitude information, gimbal angles 
are provided through a coupling data unit (CDU) . Basic trans- 
lational information is sensed by pulsed integrating pendulous 
accelerometers (PIPA's) located on the inertial platform. Early 
in the design process, the decision was made to eliminate the 
requirement for an independent set of rate-gyro sensors for the 
control function. Thus, the attitude-state-estimation function 
of the DAP is required to provide rate estimation, filtering (for 
stabilization) , and disturbance-acceleration estimation (when 
appropriate) . 


Control-])lode Requirements 

The DAP control modes are established primarily by mission 
requirements. The three required capabilities are for general 
attitude maneuver and attitude hold, general RCS translation, and 





DPS/APS-powered-f light maneuvers. A listing of the control modes 
associated with the present design is presented in Table II. The 
design of the control modes requiring phase-plane logic will be 
emphasized in this case study. 

Design Constraints 

Ntimerous constraints influenced the DAP design, the most pre- 
dominant class of which related to weight restrictions associated 
with the lunar-landing program. Weight considerations constrained 

the system design in 

TABLE II structural character- 

istics of the LM/ 

CONTROL-MODE STRUCTURE OF THE DAP CSM - structural 

bending modes are 
significant; in pro- 
pellant-sloshing 
dynamics — slosh 
baffles were removed 
early in the program; 
and in unbalanced 
couple-control re- 
quirements for APS- 
powered flight. 

Another class 
of constraints, 
generally identified 
late in the design- 
development phase, 
involved restrictions 
on RCS jet firing. 
These restrictions 
included duty-cycle constraints (because of propulsion instabili- 
ties) , exhaust-contamination constraints (particles on windows, 
optics) , thermal constraints (rendezvous radar, antennas, 
spacecraft- impingement heating) , and operational constraints 
(during extravehicular activity docking) , 

A third class of constraints that influenced the design pro- 
blem was associated with propulsion-system characteristics. The 
slow-speed trim-gimbal-actuator characteristics of the DPS were 
established for crew safety to avoid hardover actuator failures 
during powered descent of the LM. A special gear drive was 
developed to restrict the trim-gimbal-drive rate to ± 0,2 deg/sec. 
Unlike the classical actuator used for the CSM thrust-vector- 
control system, the DPS actuator cannot fail at a higher drive 
rate. A second propulsion-system constraint was associated with 
the decision to have a non-gimbaled APS engine. This decision 
imposed significant limits on allowable center-of-mass character- 
istics during powered ascent flight. Unfortunately, effective 
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control of mass-property characteristlGs is extremely difficult 
in a program such as Apollo. Another propulsion-system constraint 
was associated with the decision to locate the RCS jets 45 degrees 
from the body axes. This geometry significantly influenced the 
interaction between the RCS mode (U/V axes) and the GTS mode 
(Q/R axes) during DPS-powered flight. With respect to design and 
development , effective analytical techniques were virtually non- 
existent for this problem. 

The fourth class of constraints that impacted the design pro- 
blem included computer-oriented restrictions . The LM guidance 
computer (LGC) is limited in both fixed and erasable memories; in 
addition, definite timing restrictions are placed upon the pro- 
grams required to provide the control functions. 

Performance and Stability Criteria 

The criteria for establishing the adequacy of the DAP design 
are outlined in Table III, which lists functional criteria for 
both coasting-flight and powered-flight control modes. 

TABLE III 


PERFORMANCE AND STABILITY CRITERIA OF THE DAP 


Control modes 

Coasting flight 

Powered flight 

Transient behavior — 
acquisition and recovery 

Stability characteristics 

Limit-cycle characteris- 
tics 

Integrated AV pointing 
accuracy 

Attitude-maneuver-rate 

overshoot 

Attitude-transient be- 
havior 

RCS propellant comsump- 
tion 

Limit-cycle characteris- 
tics 

Total number of jet 
firings 

Steady-state attitude 
offset 


RCS propellant consump- 
tion 


Total number of jet 
firings 
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SCOPE OP PRESENTATION 


Primary emphasis will be given to reviewing the design of the 
LM powered-flight modes. These modes are considerably more com- 
plicated than the coasting-flight modes and provide significant 
insight into the design principles. The manual modes, as well as 
the associated displays and astronaut LGC-input functions, are 
beyond the scope of this case study. Other areas that are not 
discussed include ground/spacecraft interfaces, general operational 
procedures, and software-implementation techniques (including 
coding verification) . 


DESIGN PHILOSOPHY 
General Design Guidelines 

Various decisions made in the initial DAP control-system 
developmental plane established general design guidelines. A 
partial list of these guidelines includes: 

1. Simultaneous three-axis attitude maneuvering is 
required (as opposed to sequential-maneuver 
techniques) . 

2. Attitude rotation shall have RCS priority logic 
over translation (an alternate technique is a 
share-type logic) . 

3. The control system must provide acceptable per- 
formance with single RCS jet failures (on/off) , 
with reasonable inertia-mismatch variations, and 
without information about single externally dis- 
abled jets. 

4. The spacecraft mass-property information must 
be updated during DPS/ APS powered- flight 
maneuvers . 

5. The GTS control loop must be stabilized inde- 
pendently of the RCS control loop. 

General Philosophy 

Initially, an important question with respect to design 
philosophy was how to use the inherent flexibility associated with 
a spacecraft digital computer. This question was especially sig- 
nificant because the DAP represented a first-generation, digital 
design development. Emphasis v/as placed upon using digital 
capabilities, such as logic (switching, branching), non-linear 
computations, and function generation. For example, design con- 
siderations of the timing structure for the RCS/GTS control laws 
during DPS-powered flight included consideration of simultaneous 


- 11 - 



N 

control, sequential control, and time-interlaced logic control. 
These options are generally limited to analog control-system 
design. Another example was the reduction of switching-line 
chatter by logical branching to achieve improved performance 
under inertia mismatch, undetected jet failures, and ullage (X- 
axis translation) maneuvers. 

The concept of performance margin was an area of design 
philosophy that influenced DAP development. This concept empha- 
sized the principle that the acceptability of the design should 
be based upon performance of the system during extreme (but re- 
quired) degraded conditions. Acceptable performance during off- 
nominal conditions, such as single undetected jet failures, and 
large control-effectiveness uncertainties (thrust magnitude, 
inertia properties, thrust misalignment, actuator drive rates, 
etc.) was difficult to achieve. The performance-margin concept 
identified a general trade-off between lowering the nominal to 
achieve acceptable performance during degraded conditions and 
maintaining high nominal performance despite severe degradation 
during off-nominal conditions. The control-system designer must 
use insight and judgment in establishing the degree of degradation 
(or margin) to which the design must accommodate in terms of per- 
formance. Even after this philosophy has been adopted, the abil- 
ity to develop explicit mathematical criteria for off-nominal per- 
formance is still generally difficult to establish. 

Another general philosophy was maximum utilization of modern 
control-theory techniques and frequency-domain techniques assoc- 
iated with sampled data-control systems. For example, the 
original attitude-state estimator developed for the DPS-powered 
flight was a Kalman filter. In addition, the GTS control loop 
was developed as a time-optimal control law. The many analytical 
methods available at that time were reviewed in reference 2, the 
authors of which implied that state phase-plane techniques 
(involving simulations) would probably be the primary design tools 
in DAP development. Techniques considered, but discarded, 
included convergence and stability (Liapunov, Aizeman, Lagrange) , 
modified rate diagram, describing function, and dynamic pro- 
graming. The concepts of defining regions of attraction and 
ultimately bounded regions were found to be inapplicable for this 
design development. 

The philosophy of providing system-design flexibility to 
accommodate developmental problems or future contingencies was 
related to the concept of performance margin. An example was the 
guideline to stabilize the GTS control loop independently of RCS 
control loop. Three years after this design was initiated, 
additional thermal eonstraints (which essentially restricted all 
X-axis RCS jet firings) were identified for the LM/CSM config- 
uration during DPS-powered flight. The design was flexible 
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enough to accommodate this restriction without significantly 
affecting the program. 

The final design philosophy listed for DAP development was 
associated with the RCS propellant-performance requirements. 
Design emphasis to achieve efficient propellant usage should be 
placed upon those control functions that require the largest 
amount of propellant over a complete mission profile. For the 
DAP, these control functions included manual translations, manual 
and automatiG-attitude maneuvers, and maneuvers associated with 
powered-flight guidance. In this general sense, the importance 
of efficient RCS propellant performance for coasting-flight and 
powered-flight minimum- impulse operation should be downgraded. 
Thus , one may reasonably ask why design complexity (and assoc- 
iated verification) should be increased to save 20 percent per- 
formance on an item that uses 5 percent of the total mission pro- 
pellant. A definite trade-off exists between design complexity 
and performance- improvement payoff. 


DESCRIPTION OF DAP DESIGN 


The DAP design that was flight- tested on the Apollo 9 manned 
mission will be described in this section. This design (assoc- 
iated with the SUNDANCE flight ropes) is described in reference 3, 
and will be treated as the base line design for the case study. 
Virtually all of the following design descriptions are condensed 
from reference 3. 


Coasting-Plight Modes 

The two coasting- flight modes described are the attitude- 
hold mode, and the automatic-maneuver mode. A block diagram of 
the coasting-flight attitude-hold mode is presented in Figure 5. 

The major design elements include the attitude-state estimator, 
the RCS control laws, and the jet-selection logic, functional 
descriptions of which are provided in this section. 

The basic measurements available to the recursive state 
estimator are the three gimbal angles from the IMU. The estimator 
for coasting flight predicts both attitude and angular velocity, 
and uses non-linear threshold logic to reject low-level measurement 
noise. Angular-acceleration information caused by RCS jet firings 
is an additional input to the state estimator. 

The RCS control laws compute the requirements for rotational 
impulses, using information based upon attitude phase-plane errors, 
control effectiveness, and phase-plane targeting logic. 
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[^Gp] ” Transformation from gimbal axes to pilot axes 
[*^pc] = Transformation from pilot axes to control axes 
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Figure 5. - Coasting-flight attitude-hold mode 

The jet-selection logic combines the required rotational 
impulses with the commanded translation inputs to select approp- 
riate jets for control action. Additional information used by 
the jet-selection logic includes the desired number of jets to be 
fired and the identification of disabled jets. 

Additional design elements shown in Figure 5 are transformation 
equations and jet-timing logic. The transformation equations, 
from gimbal to pilot axes, and from pilot to control axes, are 
straight-forward, not to be presented explicitly. The jet-timing 
logic is used to establish mandatory conditions for two- jet con- 
trol in the U/V axes, and for four- jet control in the P-axis. 

A block diagram of the coasting-flight automatic-maneuver 
control mode is presented in Figure 6. Automatic maneuvers are 
implemented using the same logic as attitude hold, except for 
the attitude-maneuver routine. This routine provides desired 
steering commands in both attitude and rate, as well as generating 
a set of lag angles 6. These lag angles are introduced to pre- 
vent overshoot when initiating or terminating an automatic man- 
euver. The simplified single-plane equations for the attitude- 
maneuver routine are given as 
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where Equation (1) is computed every steering cycle 
(ATc = Nj - Nj_x = 2 sec) , and Equation (2) is computed every 
control cycle' (2Tg = 0.1 sec) . The value of is set by the 
maneuver-rate input, and aj is defined as the magnitude of the 
assumed two- jet acceleration. When the maneuver is completed, 

W(X, A0jj, and 3 are reset to zero, and the control system reverts 
to attitude hold about the desired gimbal angles. 

Powered-Flight Automatic Mode 

The control operations associated with powered flight are 
considerably more complicated than coasting-flight operations. 

Major additions for both DPS- and APS-powered flight include an 
integrated guidance and navigation outer loop that interfaces 
with the DAP through a steering routine, and a mass monitor-and- 
control parameter routine. In addition, the state estimator is 
required to derive offset angular acceleration a. The RCS control 
laws are modified by making the control effectiveness and the 
phase-plane targeting logic dependent upon the estimated offset 
angular acceleration. During DPS-powered flight, a control law 
for the GTS is required. A timing-and-control-logic interaction 
between the RCS control and the GTS control is also required. A 
block diagram of the APS powered-flight automatic control is pre- 
sented in Figure 7. The major design elements (state estimator, 
control laws, jet-selection logic) will be discussed in detail in 
the following sections. 

Control Effectiveness 

The DAP control laws and the recursive state estimator re- 
quire information on the assumed RCS and GTS control effectiveness. 
The GTS control effectiveness is represented by the rate of change 
of angular acceleration, & q , caused by constant angular-drive- 
rate command to the actuators . A flow diagram indicating those 
factors that relate to the GTS control effectiveness is presented 
in Figure 8. The factors indicated in Figure 8 are as follows: 

M = estimated mass 

L = L(M) distance from hinge pin of descent 

engine bell to center of mass of LM 
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Figure 7 . - Powered-flight automatic control of the DPS 
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I = I (M) pitch or roll moment of inertia 

AV/At = measured linear acceleration 

Uq,Uj^ ~ trim-gimbal drive commands (+1, 0, -1) 

. for Q and R channels 

6 = gimbal-drive rate of descent engine = 

0.2 deg /sec 

The effectiveness of the RCS control is represented by the angu- 
lar acceleration aj about an axis from the firing of a single 
jet. A flow diagram containing the RCS control effectiveness 
equation in the P-, Q-, R-axes, and the appropriate equations for 
transformation to the P-, U-, V-axes is presented in Figure 9. To 
represent the RCS angular acceleration as a hyperbolic function 
of mass, a nominal jet-torque level of 550 foot-pounds is assumed, 
and additional vehicle configuration assumptions are required to 
establish inertia characteristics as a function of mass. 


State Estimator 


The recursive state estimator for powered and coasting flight 
is described in -this section. The most complex estimator design, 
associated with DPS-powered flight, will described first. 

Kalman filter theory provides a reasonable structure for combining 
estimates of state changes caused by RCS jet firings and trim- 
gimbal activity with external measurements of attitude. The LM 


plant is assumed to be represented by a 
body equations of motion 

implified set of rigid 

5 = 60 

(4) 

to = a + Uj 

(5) 

a = 

G eg 

(6) 


where 0 = 

w = 
a = 




attitude 

angular velocity 

offset angular acceleration caused by 
DPS/APS thrust 

angular acceleration caused by RCS jet 
firings 

rate of change of angulatr acceleration 
caused by descent engine gimbaling 
rate of change of angular acceleration 
caused by center-of-mass movement 


The time histories of the control outputs Uj and Uq between 
sample instant tn_i and tn are assumed to be the values commanded, 
and are represented by 


- 17 - 











1 

1 

1 

1 

,1 

1 

1 

1 

1 

t 

n-l ^n-l ’ 

fn 


where ^ ~ ^ ~ control-sample period. 

The measurement equation is expressed by 

0^ = 0 + N (7) 

where N = measurement noise from vibration, tracking errors of 
the CDU, and quantization. The estimation process requires the 
development of equations for state extrapolation^and measurement 
incorporation. Given the estimate of the state 0, co, a at tj^_i, 
and assuming the time histories of Uj and Uq between tn~i and 
tn/ the extrapolated state at t^ is obtained by integrating Equa 
tions (4) , (5) , and ( 6 ) to obtain 


0 ' 
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external measurements 

attitude variables are compared with the 
to obtain an updated estimate at t^ 

/V 

S) 

= e> 



- ®'("n)] 

( 11 ) 
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( 12 ) 
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("^n) 
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l^n)^ 
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(13) 


If the filter weights, K 0 , K^^, and Kq^, are optimized based 
upon Kalman filter theory, the values are time variant, and are 
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dependent upon the values of and N, and the uncertainty in 

the initial state estimate. During the design development of 
the DAP, the optimum filter-gain concept was discarded after many 
problems were identified through simulation testing. At that 
time, a nonlinear threshold filter was developed as part of the 
base line design. This filter and the threshold values assoc- 
iated with the concept were established from direct engineering 
considerations. 

Development of the nonlinear threshold filter was motivated 

by the specific properties of the measurement noise from the IMU. 

For the design considered, the predominant measurement noise is 

derived from the nonlinear-tracking servo characteristics of the 

electronic CDU's. Gimbal-angle information encoded in the LGC • / 

(for moderate angular vehicle velocities) contains high-freguency • 

noise having a peak-to-peak amplitude of approximately 0 . 09 degree . 

It is important to note that the distribution of this noise is 

rectangular rather than gaussian. A trap filter using threshold 

logic was developed to reject this type of low-level measurement 

noise. The logic and associated filter-gain equations are as 

follows. If 0 - 0' |< 0 , then 

' m '- max' 

K„ = K = K =0 (14) 

9 w a \ / 


If 0 - 0 * > 9 , then 

' m ' max 


Kg = 1 


K 


oj n. + N 
t w 




a 


n^ t N 

t (jj 


+ N 


■K 


a 


w 


(15) 


where 


N' 

N 

n^ 


max 

(jj 


a 


= threshold value (0,14 degree) 

= rate gain constant 
= aeceleration gain constant 
= number of sample periods that have 

elapsed since the threshold was exceeded last 


Extensive testing has demonstrated that the nonlinear thres- 
hold logic suecessfully rejects low-level measurement noise. This 
filter also performs well with respect to disturbances that are 
cyclic in nature, such as slosh and structural vibrations. The 
filter gains for the rate and acceleration estimates derived by 
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Equation (15) are functions of nf If the trap overflows almost 
every time, it is generally desirable for the filter characteris- 
tics to provide a fast rate estimate and a slow acceleration 
estimate. The desired response time on the acceleration estimate 
is set by requirements to track a moving center of mass and to 
respond to time-variant thrust-actuation compliance effects. The 
upper limit on response time is restricted because of the desire 
to avoid rapid fluctuations in the autopilot switching curves and 
because of the requirement to attenuate slosh accelerations. 

If the threshold logic be exceeded only rarely, a maximum 
incorporation of the measurement is generally desired. The logic 
given in Equations (14) and (15) is actually a simplification of 
the developed design. The threshold value is actually compared 
with the total unexplained attitude that has accumulated since 
the last trap overflow, where the incremental amount for one con- 
trol-sample period is the difference between the measured and the 
predicted changes in attitude. 

■ A summary of the input and output variables associated with 
the state estimator for DPS-powered flight is presented in 
Figure 10. 

The structure of the estimator for APS-powered flight is 
identical except that the variables associated with the GTS are 
deleted. Similarly, the state estimator for coasting flight is 
based upon the same structure, except that the estimated state 
does not include offset angular acceleration. The total estimator 
design represents an integrated concept with respect to both 
powered and unpowered modes of control. To conclude this section, 
the dynamical effects not explicitly considered in th ' initial 
development of the filter equations will be iden fied, as fol- 
lows : 

1 . 

2 . 

3. 

4. 

5. 

6 . 

7. 

8 . 

9. 

10 . 

11 . 


Propellant-slosh dynamics 
Structural-bending dynamics 
J et-impingement-f orces model 
Jet-thrust lags 
Jet-misalignment geometry 

Jet acceleration caused by Y/Z translation 
Undetected jet failures 
Trim-gimbal lags 
Inertial mismatch 
DPS-actuator-compli$(]fice. model 
Pifopellant-fuefL-shift model/ '' !’ ,• *, 
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^J ,P' ^J,Q' ^J,R Assumed RCS control effectiveness 

^n/ Assumed GTS control effectiveness 
Q R 

Configuration bit 


gimbal-to-pilot increment matrix 
®raax' filter parameters 


Gimbal angles 

®o' ®r 


(Direct measurement) 



*“Q' '"R 


Angular velocity estimate 




Bias angular acceleration estimate 


Uqv 

Trlm-gimbal activity 


tp/ ty, ty 

Signed firing durations 

Hp, n^, ny 

Number of jets selected 


Figure 10. * Input and output variables of the state 

estimator 


Other assumptions that modified the estimator equations 
implemented in the filter design were that the cross products of 
inertia terms were ignored; that the terms in Equations (8) and 
(9) caused by the trim-gimbal drive Uq were deleted; and that 
second-order rate terms were ignored in the equations of motion. 

Detailed verification testing was ■required to demonstrate 
the stability and performance, including the known dynamical 
effects, of the total system. Simulation testing supported the 
establishment of the critical filter values of 6max' 
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An important consideration was testing the filter performance 
when an undetected jet-off failure existed. When this condition 
occurs, the acceleration estimate will seek an average value 
double the actual acceleration offset present. Because the DPS 
acceleration-nulling control law is a function of the sign of the 
acceleration-offset estimate, and is invariant with the magnitude, 
this control law will seek the center of mass properly when un- 
detected jet-off conditions exist. 

RCS Control Laws 

The control laws associated with the RCS establish jet-firing 
durations (TJET values) based upon phase-plane logic and assumed 
control effectiveness. These control laws are predictive in 
nature and are related to the classical two-point -boundary-value 
problem. To some extent, this predictive design is inherently 
sensitive to the uncertainties in control effectiveness and 
unmodeled disturbances. A description of the TJET LAWS associated 
with the LM descent and ascent configurations is provided in this 
section. 


Angular error/error-rate phase planes are established for 
each P, U, and V RCS control axis. Because the sets of jets 
that produce rotation about each of these three axes are distinct, 
the P-, U-, and V-axis jets are turned on and off independently. 

A block diagram of the control-law inputs for the LM descent and 
ascent configurations is presented in Figure 11. 





Ep, E^, Ey 


^netpos 

a 

netneg 

^coastpos 

^coastneg 


0 !^ 




RCS CONTROL LAWS 

TJETp 

1. ROUGH LAW 

2 . FINE LAW ■" coasting 

3. FINE LAW ■“ powered no. 1 

TJETy 

TJET^ 

4. FINE LAW "• powered no , 2 


t f f r 



Zone s FLAT DB I VZ-jet performance 


LIM U/V axes 


/ 


Figure 11. - TJET LAWS, LM only 


The attitude and rate errors (E,E) are used to establish the 
estimated state location in the phase plane. The acceleration 
inputs required by the RCS control laws include net angular 
acceleration (jet acceleration plus offset acceleration) , and 
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coasting acceleration (acceleration caused by offset alone) . The 
basic shape of the target parabolas and switching- line parabolas 
are set by this angular-acceleration information. Additional 
inputs — deadband (DB) and FLAT — establish the positional loc- 
ation of these parabolas. The four different phase-plane config- 
urations associated with the DAP design are listed in Figure 11. 
The TJET control logic is developed by dividing each phase-plane 
configuration into coasting and firing zones. 

The ROUGHLAW phase-plane configuration shown in Figure 12 
is used for all control modes whenever either the magnitude of 
E exceeds 11.25 degrees or the magnitude of E exceeds 5.625 



Figure 12. - The ROUGHLAW phase plane 


deg/sec. If neither of these limits be exceeded, a FINELAW 
phase-plane configuration is used in the RCS control logic. 

The use of ROUGHLAW for large values of E and E permits the 
efficient use of single precision arithmetic by the LGC. The com- 
putational ability to provide independent scaling for different 
regions of the error phase plane provides a significant flexibility 
compared with most of the analog control-system designs. The 
ROUGHLAW phase-plane configuration is divided into zones A to D. 

The logic for computing TJET for the upper half plane of ROUGHLAW 
is presented in Table IV. 

The three phase-plane configurations associated with FINELAW 
are shown in Figures 13, 14, and 15. The configurations include 
drifting flight, powered-descent flight when the trim-gimbal 
nulling times are less than 2 seconds, and powered-ascent flight 
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TABLE IV 


ROUGHLAW TJET LOGIC 


Location 
of the 
LM state 

Basic of computing TJET 

Zone A 

• 

TJET is the time required to drive E 


to -5.625 deg /sec. 

Zone B 

TJET is set equal to 0.250 sec; that 


is, a "large" value. 

Zone G 

TJET is set equal to zero , that is , 


no jets are turned on. 

Zone D 

• 

TJET is the time required to drive E 


to +5.625 deg /sec. 


or when the trim-gimbal nulling times are greater than 2 seconds. 
The FINELAW TJET logic for coasting flight is presented in 
Table V. 

The zones 2 and 3 logic was developed to acquire a minimum- 
impulse limit cycle efficiently. The motivation for occasionally 
permitting the jets to remain on in zone 4 was to avoid switching- 
line chatter when the net angular acceleration is underestimated ' 
because of inertia mismatch. 

The FINELAW phase-plane logic for powered-descent flight 
when the trim-gimbal nulling times are less than 2 seconds is 
identical to the coasting logic of Table V, except that zone 3 
has been eliminated. This logic provides an efficient interface 
between the RCS and GTS control systems. 

The FINELAW logic for the phase-plane configuration assoc- 
iated with Figure 15 is also similar to the coasting logic of 
Table V. The principal exceptions are that zones 2 and 3 have 
been eliminated, and that the logic developed from zone 4 is to 
target to intersect a parabola instead of the E-axis plane . 

As mentioned previously, the DBi through DB 4 parameters, 
together with FLAT, are used to establish the positions of the 
phase-plane parabolas. The intercept values were established 
empirically through simulation testing, and are proportional to 
the DB. The proportionality constants, which were developed to 
depend logically upon the estimated offset acceleration, are 
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Figure 15. - The FINELAW phase plane when the LM is in 
powered ascent or when either of the trim-gimbal 
nulling drive times is greater than 2 seconds 
during powered descent 


TABLE V 


FINELAW, COASTING TJET LOGIC 


Location 
of the 
LM state 


Zone 1 


TJET is the 


state to a 


Basis of computing TJET 


time required to drive the LM 
"target parabola." 


Zone 2 
Zone 3 
Zone 4 


Zone 5 


TJET is the time required to drive the LM 
error rate to zero, 

TJET is set so small that the jet-selection 
logic will fire a one- jet minimum impulse, 

TJET is set to zero unless the jets for the 
axis concerned are already on and are driving 
the LM state to intersect the E axis between 
“DB 2 and DBj^. 

TJET is the time required to drive the LM 
state to a "target parabola." 
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presented in Table VI. The general design strategy was to set 
the position of the parabolas to yield small, average, steady- 
state attitude errors during powered flight. The classic analog 
control-system trade-off of establishing a single switching-line 
logic to provide adequate performance during both high- and low- 
disturbance-torque conditions is avoided in this design. 

Another input required for the RCS control laws is the 
indication of one- jet or two- jet couple preference for U/V axes 
control. Normally, one- jet control is desired for powered ascent 
and X-axis translation. However, additional logic associated 
with large phase-plane errors is used, requiring mandatory two- 
jet couple control when certain conditions are exceeded. 

For the P-axis, the computation of TJET is always made on 
the basis of two- jet couples. However, the TJET logic is over- 
ridden and four jets are fired for 0.1 second if certain TJET 
values arid error-state conditions are exceeded. 

Jet-Selection Logic 


The RCS control laws establish requirements for some number 
of jets to be fired about the P-, U-, and V-axes. The translation- 
acceleration requirements are obtained directly from guidance 
inputs or manual commands. The jet-selection logic determines 
the RCS jet policy when provided the desired rotational torque 
information, the desired direction of translation, and the desired 
number of jets to be used for each maneuver. In addition, the 
firing logic is modified when jets are known to be disabled. 

The jet-selection policies associated with the P-axis 
rotation and the Y- and Z-axis translations are presented first. 
Because rotation takes priority over translation, the Y- and Z- 
axis commands are executed only when no P-axis commands are pre- 
sent. The normal P-axis jet-selection policy is presented in 
Table VII. 


If any of the rotation policies given in Table VII involves 
a disabled jet, then alternate two-jet rotation policies will be 
attempted in the following sequential order until a policy involv- 
ing only enabled jets is found. 


+P Rotation 


-P Rotation 


7, 15 
4, 12 
4, 7 
7, 12 
12, 15 
4, 15 


8, 16 
3, 11 
8 , 11 
11, 16 
3, 16 
3, 8 
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TABLE VI 


CRITERIA TO DETERMINE THE INTERCEPT 
OF THE PHASE-PLANE PARABOLAS 


Define 


a„. - 1.4 deg /sec 

mm 


A = estimated offset angular acceleration 
os 


For powered flight (except when both of the commanded trim-gimbal 
nulling drive times are less than 2 sec during powered descent) 

FLAT = 0 and 


a) If A >a . , 

' os min' 

c) 

If a . >A >0.5a . , 

min os min 

DBj^ = DB,DB2 = 2DB,DB3 - 


DBj^ = DB,DB2 = DB,DB3 - 

-0.75DB, DB^ = 2DB 


0.5DB,DB^ = Db' 

b) If A^^ , 

os min 

d) 

If -0.5a . >A >-a . , 

min os min 

DB^^ = 2DB,DB2 - DB,DB3 = 


DB^^ = DB,DB2 = DB,DB3 = 

2DB,DB^ = -0.75DB 


DB,DB^ = 0.5DB 


e) 

If 0.5a_- >A >-0.5a_. , 
mm os mxn 



DB = DB2 “ DB^ = DB^ - DB 

For drifting flight (and when 
nulling drive times are less 

both 

than 

of the commanded trim-gimbal 
2 sec during powered de- 


scent) 

DB^ = DB2 = DB,DB^ = DB3 = DB + FLAT, 
and FLAT = 0.8 deg 
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TABLE VII 


P-AXIS NORMAL JET-SELECTION POLICY 


Type of rotation 

Jet-selection policy 

4-jet, +p 

4, 7, 12, 15 

2-jet, +P 

Alternate pulses between 4 and 


12, and between 7 and 15 

4-jet, -P 

3, 8, 11, 16 

2-jet, -P i 

Alternate pulses between 3 and 


11, and between 8 and 16 


The normal Y- and Z-axis translation policies, with alternate 
policies for disabled jets, are presented in Table VIII. 

The jet-selection policies associated with the U- and V-axis 
rotations and the X-axis translation are now presented. If no 
conflict exists between jets required for translation and rotation, 
then both policies are executed. However, if a conflict exists, 
only the rotation policy is applied. 


The U- and V-axis rotational policies for both normal and 
disabled- jet conditions are presented^ in Table IX. 

Finally, the X-axis translational policies for both normal 
and disabled- jet conditions are presented in Table X. 

If no alternate disabled- jet policies be possible, a com- 
puter program alarm is lighted and an alarm code informs the 
astronauts that a rotation or translation failure exists. This 
alarm procedure is applicable for all of the jet-selection pol- 
icies presented. 


GTS Control Laws 

Two s low-speed actuators are used to gimbal the descent 
engine about the Q- and R-axes. The control modes developed for 
commanding these trim actuators are an attitude-control mode, 
and an acceleration-nulling mode . 

The control law associated with the attitude-control mode 
has been developed to be a function of errors in attitude, rate. 
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TABLE VIII 


Y- AND Z-AXIS JET-SELECTION POLICIES 


Type of 
translation 

Normal policy 

Alternate disabled- jet policy 

+Y 

12, 16 

If 16 has been disabled, set up 
the tacking policy of aiternating 
between 12 and 3 , and between 
12 and 11. 

If 12 has been disabled, set up 
the tacking policy of alternating 
between 16 and 15, and between 
16 and 7 . 

-Y 

00 

If 8 has been disabled, set up 
the taeking policy of alternating 
between 4 and 3 , and between 
4 and 11 • 

If 4 has been disabled, set up 
the tacking policy of alternating 
between 8 and 7, and between 
8 and 15 . 

+Z 

i 

1 

■ 

If 11 has been disabled, set up 
the tacking policy of alternating 
between 7 and 8 , and between 
7 and 16 . 

If 7 has been disabled, set up 
the tacking policy of alternating 
between 11 and 12, and between 
11 and 4 , 

-Z 

3, 15 

If 15 has been disabled, set up 
the tackingj policy of aiternating 
between 3 and 4, and between 
3 and 12. 

If 3 has been disabled, set up 
the tacking policy of alternating 
between 15 and 8 , and between 
15 and 16. 
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TABLE VIII 


Y- AND Z-AXIS JET-SELECTION POLICIES (cont) 


Type of 
translation 

Normal policy 

Alternate disabled- jet policy 

+Z,+Y (+U) 

7, 11, 12, 16 

If either 11 or 12 has been 
disabled, use 7 or 16. 

If either 7 or 16 has been 
disabled, use 11 or 12. 

-Z,-Y (-U) 

3, 4, 8, 15 

If either 8 or 15 has been 
disabled, use 3 or 4. 

If either 3 or 4 has been 
disabled, use 8 or 15. 

+Z,-Y (+V) 


If either 4 or 11 has been 
disabled, use 7 or 8. 

If either 7 or 8 has been 
disabled, use 4 or 11. 

-Z,+Y (-V) 

3, 12, 15, 16 

If either 15 or 16 has been 
disabled, use 3 or 12. 

If either 3 or 12 has been 
disabled, use 15 or 16. 


TABLE IX 


U- AND V-AXIS JET-SELECTION POLICIES 


Type of 
rotation 

Translational 
sense required 

Normal 

policy 

Alternate disabled- 
jet policy 

2-jet,+U 

— 

■ 

If 14 has been disabled, 
use 5 alone; if 5 has been 
disabled, use 14 alone. 

1-jet, +U 

+x 

14 

If 14 has been disabled, 
use 5. 

1-jet, +U 

-X 

5 

If 5 has been disabled, 
use 14. 
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TABLE IX 


U- AND V-AXIS JET-SELECTION POLICIES (cont) 


Type of 
rotation 

Translational 
sense required 

Normal 

policy 

Alternate disabled- 
jet policy 

2-jet,-U 

— 

6, 13 

If 13 has been disabled, 
use 6 alone; if 6 has been 
disabled, use 13 alone. 

1-jet, -U 

+x 

6 

If 6 has been disabled, 
use 13 . 

l-jet,-U 

-X 

13 

If 13 has been disabled, 
use 6. 

2-jet,+V 

— 

1, 10 

If 10 has been disabled, 
use 1 alone; if 1 has been 
disabled, use 10 alone. . . 

l-jet,+V 

+x 

10 

If 10 has been disabled, 
use 1 . 

l-jet,+V 

-X 1 

1 

If 1 has been disabled, 
use 10 . 

2-jet,-V 

i 

2, 9 

If 9 has been disabled, 
use 2 alone; if 2 has been 
disabled, use 9 alone. 

l-jet,-V 

+x 

2 

If 2 has been disabled, 
use 9 . 

l-jet,-V 

“X 

9 

If 9 has been disabled, 
use 2. 


TABLE X 


X-AXIS JET SELECTION POLICY 


Type of 
translation 

Normal policy 

Alternate disabled- jet policy ; > 

4-jet,+X 

2, 6, 10, 14 

If either 2 or 10 has been 
disabled, use 6 or 14 

If either 6 or 14 has been 
disabled, use 2 or 10 . 
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TABLE X 


X-AXIS JET SELECTION POLICY (cont) 


Type of 
translation 

Normal policy 

Alternate disabled- 
jet policy 

2-jet,+X 
(fuel 
system A) 

2, 10 

If either 2 or 10 has been 
disabled, use 6 or 14. 

2-jet,+X 
(fuel 
system B) 

6, 14 

If either 6 or 14 has been 
disabled, use 2 or 10. 

4-'jet , -X 

1, 5, 9, 13 

If either 5 or 13 has been 
disabled, use 1 or 9. 



If either 1 or 9 has been 
disabled, use 5 or 13. 

2-jet, -X 
(fuel 
system A) 

5, 13 

If either 5 or 13 has been 
disabled, use 1 or 9. 

2-jet, -X 
(fuel 
system B) 

1,9 

If either 1 or 9 has been 
disabled, use 5 or 13* 


and acceleration. The control-law equations are basically a 
modification of a time-optimal solution, and ate given as 


K = 0.3M 


A = -sgn 


u = -sgn 


^ . 
^ L 6 

I 


xe + 


6 e 


K^e + B { t 


AK6 + A AK0 



(16) 


(17) 

(18) 


The control output commands the sign of the change in angular 
acceleration. The sampling period for this mode is set at 200 
milliseconds. Referring to Equation (16), the time-optimal law 
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is modified by a 0.3 gain factor in the assximed control- 
effectiveness term K. This reduction is designed to avoid tran- 
sient-response overshoot, and to prevent large steady-state limit 
cycles. However, this gain should be kept reasonably high to 
provide good transient-response characteristics. 


The GTS control law associated with the acceleration-nulling 
mode is designed to regulate the offset (disturbance) acceleration 
from the descent thrust. The primary dynamical environments that 
cause offset acceleration include shifting center-of-mass prop- 
erties, DPS actuator compliance, and DPS engine-ablation effects. 
This control law is structured in the form of a trim-gimbal drive- 
time equation, and is given as 


T = 0.4 


0 


M L6 


(19) 


The principal sampling period associated with the acceleration- 
nulling law is 2 seconds. However, under certain conditions, this 
acceleration-nulling law is used as part of the basic RCS control- 
law timing structure.- The interaction and timing logic between 
the RCS and GTS control laws are presented in the following 
section . 


RCS/GTS Interface 

During DPS-powered flight, the GTS is generally adequate to 
provide satisfactory control in the Q/R axes when the maneuver 
requirements are slowly varying. It is believed that the GTS 
should provide complete control (rather than regulation of the off- 
set acceleration) whenever possible, to limit jet firings and to 
minimize RCS propellant usage. During design of the DAP, a time- 
shared control logic was developed in which the use of RCS and 
GTS controls are interfaced to minimize mutual interaction. 


The RCS/GTS interface has been designed so that the RCS 
phase-plane state is examined for a logical decision (and the RCS 
control law applied) at least every 200 milliseconds. The time- 
line operation is as follows . 


t 


t + 100 msec 


t + 200 msec 


t + 


300 msec 


RCS 

Test for 

RCS 

Test for 

control 

(1) 

Attitude- 

control 

(1) 

Attitude- 

law 


control law 

law 


control law 


(2) 

Acceleration- 


(2) 

Acceleration- 



nulling law 



nulling law 


(3) 

RCS control 


(3) 

RCS control 



law 



law 
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The test logic associated with use of the attitude-control 
law every 200 milliseconds is that the trim-gimbal drive times 
(in the Q- and R-axes) must be less than 2 seconds lEguation {19)3, 
and that all U and V RCS jets must be off. 

The requirements associated with the use of the acceleration- 
nulling law are that the attitude-control law must have been used 
on the previous pass, and that the test logic for present use of 
attitude-control law must have failed. 

Therefore, in the RCS/GTS timing loop, the acceleration- 
nulling law is used only as a transaction between the attitude- 
control law and the RCS control law. 

In addition to the RCS/GTS timing loop, another routine 
executes a test for the GTS acceleration-nulling law every 2 sec- 
onds. . The nulling law is applied if, and only if, the trim 
gimbal is not under GTS attitude control (at least one of the two 
test conditions is not satisfied) . This "captive" logic is 
designed to prevent a sustained thrust offset when the RCS control 
laws are commanding jet firings to counteract the disturbance 
acceleration. 


HISTORY OF DESIGN DEVELOPMENT 


The history of DAP development will be discussed by pre- 
senting base line designs for the design-formulation phase 
(September 1964 to December 1966) and for the SUNBURST flight- 
program phase (December 1966 to August 1967). Where applicable, 
comparisons will be made to the SUNDANCE base line design pre- 
viously discussed. The significant problems encountered will 
also be discussed. 

Apollo 5, the first (unmanned) LM mission, was launched into 
earth orbit January 22, 1968, and used the SUNBURST flight pro- 
gram. Following this mission, a decision was made to simplify 
the DAP logic, and a significant redesign of the control system 
was begun, resulting in the SUNDANCE digital program. This de- 
sign version was flight tested on the first manned LM mission 
(Apollo 9) , launched March 3, 1969. Subsequent lunar- landing 
missions will be flown using a slightly-modified SUNDANCE flight 
program. 


Preliminary Design Development 

Many modifications in design philosophy and in control- 
system implementation occurred during the preliminary design phase 
of DAP development. Excellent insight into the various control- 
system problems encountered is provided by reference 4 . To estab- 
lish background for a discussion of design problems, a base line 



block diagram using assumed conditions was formulated (Figure 16) . 
The major design areas to be discussed include RCS control- law 
formulation, estimation concepts, RCS/GTS control-mode interaction 
logic, and RCS switching logic. 


reproducibility op Twb. 


(Powered 



Figure 16 . - Preliminary design control system 

Three types of estimation programs were developed (an inte- 
grated design concept had not established at that time) . For 
coasting flight, a simple rate estimator was established; for 
powered ascent, a combined rate and acceleration estimator was 
designed; and for powered descent, a Kalman filter was developed 
for the GTS control-law function, and a rate estimator for the 
RCS control-law function. 

Two control modes were provided for the powered-^descent 
operation. The primary mode controls the Q- and R-axes with the 
GTS, and the P-axis with the RCS. The secondary control mode 
uses the RCS to control all rotational axes. The primary and 
secondary control modes were designed to be exclusive as shown 
by the interface logic (Figure 17) . When any primary-logic con- 
dition is exceeded, control is switched to the secondary mode, 
and an open-loop GTS drive is performed, using data based upon 
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the drive time derived from Equation (19) . A Kalman filter 
estimate of offset acceleration A^g is required, and is calculated 
in the primary mode in which undetected RCS jet failures are not 
a design factor. During the nominal secondary-mode operation, 
the RCS jets are commanded off every 10 seconds, and a Kalman 
filter estimate of the current offset acceleration is obtained. 
After this sequence, the RCS control is reinstated, accompanied 
by a new trim-gimbal open-loop drive. The logic conditions nec- 
essary to effect transfer from the secondary to the primary con- 
trol are also presented in Figure 17. It should be noted that • 
all conditions must be satisfied to return from secondary to 
primary control. The problems associated with this logic-design 
concept will be discussed in a following section. 



Figure 17. - Interface logic of the RCS/GTS 

A significant design decision required in the initial devel- 
opmental ^period was associated with the philosophy of RCS control 
law. The two fundamental concepts considered were a predictive 
control law based upon a two-point-boundary-value approach in the 
error phase plane, and a logic-determination technique requiring 
only present- and past-state information to calculate modulated 
jet commands. When the two concepts were being considered, the 
logic-modulation technique had the advantage of considerable de- 
sign experience because of analog control-system development. 
Hence, the basic decision was whether to establish the control- 
law design by digitizing a known analog-autopilot concept, or 
by developing a predictive control law solely based upon digital 
principles . 

The logic-determination techniques available included pulse- 
frequency modulation, pulse-width modulation, pulse-ratio mod- 
ulation (PRM) delta modulation, and integral pulse-frequency mod- 
ulation. The development of two proposed designs that use PRM 
techniques is discussed in references 5 and 6, The input to the 
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modulator is typically obtained from attitude-error and rate 
information, as shown in Figure 18. 



Figure 18. - Generation of control-error signal 

The various trade-off factors between the digital PRM and 
the predictive control law are worthy of discussion. For nominal 
conditions, the predictive control law is generally more efficient 
in RCS propellant usage, (an Igp penalty occurs for pulses shorter 
than 80 milliseconds) , and usuajLly commands a smaller number of 
jet firings. The principal disadvantages of the predictive 
approach include the sensitivity to plant uncertainties, such as 
inertia, thrust, and undetected jet failures, and the storage 
requirements for a large computer memory (parameter tracking, pre- 
diction logic, and recursive-filter techniques) , 

The most significant advantage of the digital PRM approach 
is that all logic is based upon present- and past-state infor- 
mation. Thus, for large off-nominal conditions, this approach 
has distinct advantages over the predictive design. The dis- 
advantages include the sensitivity to noise because of low-value 
threshold logic, and the large steady-state attitude offsets for 
sustained disturbance-torque conditions. The digital PRM system 
cited in reference 5 estimated a sampling-rate requirement of 30 
to 40 samples per second. A modification to this PRM concept, in 
which both on-time and off-time were calculated and the sampling 
requirement was reduced to 10 samples per second, is discussed in 
reference 6. A general trade-off exists in the area of sampling, 
because a good predictive system will generally require lower 
sampling rates than a comparative logic-determination system. 
However, off-nominal environmental conditions (and basic plant un- 
certainties) tend to increase the sampling-rate requirements of a 
predictive system. Thus, an estimate of expected plant uncer- 
tainties and environmental conditions is important in establishing 
sampling-requirement trade-offs between predictive and logic- 
determination control laws. After extended consideration, the 
decision was made to develop a predictive control law for the DAP 
design. , 
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The initial concept of the phase-plane switching logic is 
discussed in reference 7 . This design concept includes a com- 
bination of parabolic and linear curves to represent the switching 
and targeting lines . The phase-plane logic , assuming a positive 
disturbance torque, is presented in Figure 19. The value of the 
intercept constant B is dependent upon the deadband, jet-control 
acceleration, and offset-disturbance acceleration. The basic 
purpose of establishing switching-line equations that vary with 
disturbance acceleration is to lower the average steady-state 
attitude error. I 



Figure 19. - Preliminary-design phase-plane logic 


Most of the significant problems associated with the pre- 
liminary design were identified as a result of extensive simula- 
tion testing. The problem of estimating rate and acceleration 
when undetected jet failures existed proved to be especially 
difficult. Consideration was given to the use of multiple Kalman 
filters to estimate (from spacecraft dynamics) which of the 16 
jets had failed, and to adjust the control functions accordingly. 
A second approach (subsequently implemented) was using the Kalman 
filter equations only when the GTS control law was operative or 
when the RCS jets were inhibited. However, disabling control 
during powered flight for the time needed to obtain good Kalman 
filter estimation was considered unacceptable and the technique 
was then discarded. 
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A second problem was that minimum-impulse operation was not 
achieved using the initial design. Design-verification studies 
indicated that this problem was caused by rate-estimation in- 
accuracies and quantization effects. Four phase-plane logic mod- 
ifications were considered; establishing a zone 3 concept 
(Figure 13), discounting the computed TJET time when in zone 2, 
setting the derived rate (under certain conditions) equal to a 
relatively large magnitude with the sign changed from the value 
used previously, and establishing the value FLAT as a function of 
inertia. The first modification was implemented in the prelim- 
inary design. 

Significant design problems were identified with respect to 
Kalman filter performance. In simulation testing, this estimator 
was shown to be sensitive to slosh disturbances and large initial 
conditions. Furthermore, during the DPS start transient, the 
filter performance exhibited poor convergence because of engine 
compliance, propellant-fuel shift, and initial engine-mistrim 
conditions. The manner in which the Kalman filter estimate of 
acceleration was initialized was also of concern. The GTS open- 
loop drive technique influences how the initial acceleration 
estimate should be set for the next pass. The filter-extrapolation 
equations were also modified during the preliminary design phase. 
Originally,, the equations did not use information on the assumed 
GTS control effectiveness . The addition of the Uq term 
[Equation (10)] substantially improved the performance of the 
Kalman filter. 

Another preliminary design problem concerned the vehicle 
performance during the DPS start transient. The convergence 
characteristics between the primary and secondary control modes 
were demonstrated to be marginal. The interaction of the GTS and 
RCS control modes under off-nominal conditions was of concern at 
that time, and proved to be a major motivation in the subsequent 
decision to redesign the control system. 

The final problem concerned rate-overshoot performance during 
coasting maneuvers . The command-maneuver logic did not explicitly 
account for the finite time required to accelerate or decelerate 
to the desired maneuver rate, and additional jet firings resulted. 
To solve this problem, lag angles were provided to prevent over- 
shoot when initiating or terminating an automatic maneuver. 

To conclude this section on preliminary design, a few general 
remarks on the control-system performance under off-nominal con- 
ditions are worthy of mention. Performance-verification studies 
indicated that the control system was insensitive to noise and 
small disturbance-torque conditions, but sensitive to inertia 
variations and thrust degradations (including undetected jet fail- 
ures) . 
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I 

I 

I 

/ 

SUNBURST Design Development j 

I 

The base line design developed for the initial flight pro- j 

gram (1) and design problems that occurred in that time period / 

are presented in this section. The flight-test results of the / 

SUNBURST DAP, flown on the Apollo 5 mission, will be presented in' 
a later section. This description of the SUNBURST design empha- 
sizes the modifications and additions to the preliminary base 
line design. 

The state-estimator equations are structured in a manner 
similar to that outlined in the description of preliminary design. 

The rate equation for coasting flight is given by 


/s 



(1 - K) [ 2^.^ + ajtj] + I 




^ - ? 
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n-l 


(20) 


The rate-estimation equation for poweredj.fl4ght is identical to 
Equation (20) except that the term (1 - j TAqs is added to the 
right-hand side. Aog is defined as the estimated disturbance 
acceleration caused by a main-engine thrust. During descent, 

^ g is determined every control period (T = 0.1 second) by 


■^os '^os , 
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( 21 ) 


For powered ascent, the A,._ estimate is evaluated every 2 seconds 
by 




“K) 




~0) 


Jt^ - 2 J - J* Uj (t) dt 


'i-2 


( 22 ) 


It is interesting to note that the rate- and aceeleration- 
estimate equations are coupled for ascent. 'The filter gains, K 
and C, were established through detailed simulation testing. The 
nominal value of K for coast and descent is 0.5. The gains values 
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for ascent are time variant to accommodate a nominal offset- 
acceleration profile and are given as 


0.44 + 

0.56 t 
400 

(23) 

0.25 + 

0 . 5 t 
400 

(24) 


Kalman filter equations are used during the primary (GTS) 
mode and are updated every 50 milliseconds. These equations are 
programed in gimbal-angle coordinates and are given as 
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The assumed extrapolated state equations are expressed by 

CDU' - CDU„ 1 + C 
n n- i 


n 


'n-1 


CDU' 


^ + cdu^_3_ 

m rm 

1 _L n — 

2 ^ 6 

(28) 

C: 1 



+ CDU T T -f U, 

P 

(29) 

n-1 ( 

3 2 

t 

^ -f U T 

CDU 


(30) 


where the assumed GTS control-effectiveness term is transformed 
to gimbal-angle coordinates . 

A description of the RCS control laws associated with the 
SUNBURST design is necessary to the discussion of development. 

The basic structure of the switching lines was modified from the 
structure shown in Figure 19 to a format using only parabolic 
equations. Most of the design description has emphasized the 
single-plane aspects of the control-system development. A design 
area unique to the LM-thruster geometry (RCS jets 45 degrees from 
the body axes) was the logic of establishing the desired axes of 
rotation when simultaneous errors in pitch and roll occur. For 
the SUNBURST design, the Q/R axes were chosen for the control 
laws, and the concepts of urgency functions and urgency plane 
were established. Urgency functions in both the Q- and R-axes 
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were developed to measure the state location from the coast 
region, as well as to measure the RCS propellant penalty if the 
design to apply torque be deferred. These functions are approx- 
imately equivalent to the torquing time needed to reach the 
boundary of the coast region. The logic flow associated with the 
urgency-function concept is presented in Figure 20. 

The urgency plane used to select the desired axis of rotation 
is illustrated in Figure 21. 

The two urgency functions Uq and Ur define a position in the 
urgency plane and thus establish the desired axis of rotation from 
the eight rotation sets available (±R, ±Q, ±U, ±V) . Additional 
logic is applied to determine the number of jets to be used in the 
chosen axis. 


Two altei^nate approaches will give some insight into the de- 
sign trade-offs. To illustrate the techniques, one must assume 
that the urgency functions in Ur and Uq are initially established 
as shown in Figure 22a. The SUNBURST design logic will command 
a U rotation, then an R rotation, then a U rotation — until the 
urgency-function errors are nulled. An alternate design approach 
would be to null all U errors first, and then command the re- 
maining R errors^ as shown in Figure 22b. 

The alternate approach is attractive in that advantage may 
be taken of the diagonal- jet moment arm; but, during certain dis- 
turbance-torque conditions, the delaying of the R correction could 
give undesirable performance. A second alternate approach (im- 
plemented in the subsequent redesign) would be to transform the 
original errors into the U- and V-axes, and to command U and V as 
shown in Figure 22c, Because the control-axis torques in U and V 
are decoupled, these corrections can be applied simultaneously. 

The logic simplifications that result from this design approach 
are significant; however, inefficiencies do occur for a detected 
jet failure, as discussed in reference 8. 


A brief description of the GTS control laws associated with 
the SUNBURST design is needed. The time-optimal attitude-control 
law provided by equations (16) , (17) , and (18) was ’developed for 

the primary control mode in which the attitude-state errors are 
obtained from the Kalman filter equations. This design satisfies 
the requirement for an independently stabilized DPS control. The 
GTS acceleration-nulling law is used as part of the transfer logic 
from the primary mode to the secondary mode. The open-loop drive- 
time equation is 
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Compute Q and R errors 


Compute Q and R urgency functions 


From urgency plane, determine best 
axis of rotation and number of jets 


Compute TJET values 


Figure 20. - 

Urgency-function logic flow 
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Figure 21. - Urgency plane 








Figure 22a. - SUNBURST 
urgency concept 



SUNBURST urgency concept 



Figure 22c. - Another alternate SUNBURST urgency concept 

where a is the Kalman filter estimate of offset acceleration. A 
major difference between the SUNBURST design and the preliminary 
design was elimination of the technique of disabling RCS jets 
during powered flight to obtain Kalman filter estimation during 
the secondary control mode. This elimination restricted the GTS 
acceleration-nulling law function to an open- loop drive as part 
of the RCS/GTS transfer logic. The resultant performance pro- 
blems associated with this interface will be discussed later. 

The final SUNBURST design description to be presented are 
the Q- and R-axis jet-selection policies. The Q- and R-axis 
rotational policies for both normal and disabled- jet conditions, 
with alternate policies listed in order of preference, are pre- 
sented in Table XI , 
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TABLE XI 


Q- AND R-AXIS JET-SELECTION POLICIES 


Type of 

rotation 

Normal 

policy 

Alternate disabled- 
jet policy 


+Q 


2, 

5, 

9, 14 

' . n 1. 

2, 5; 9, 14; 2, 14; 

5, 9 


-Q 


1, 

6, 

10, 13 

1, 6; 10, 13; 1, 13; 
6, 10 


+R 


1, 

5, 

10, 14 

1, 14; 5, 10; 1, 5; 
10, 14 


-R 


2, 

6 , 

9, 13 

6,9;2,13;2,6; 
9, 13 


+u 


5, 

14 


14; 5 


-u 


6, 

13 


6; 13 


+V 


1, 

10 


10; 1 


-V 


2, 

9 


2; 9 

+Q 

(+x 

sense^) 

2, 

5, 

9, 14 

2, 14; 2, 5; 9, 14; 
5, 9 

-Q 

(+x 

sense ) 

1, 

6, 

10, 13 

6, 10; 1, 6; 10, 13; 
1, 13 

+R 

(+x 

sense ) 

1, 

5, 

10, 14 

10, 14; 1, 14; 5, 10; 
1 , 5 

-R 

(+x 

sense) 

2, 

6 , 

9, 13 

2 , 6 ; 6 , 9 ; 2 , 13 ; 
9, 13 


cl 

The -X sense poliGies are only slight modifications of the 
+X sense policies listed. 


Several problems occurred during the SUNBURST design phase. 
The general area associated with the descent primary/secondary 
mode interface was tested under extreme conditions, with parti- 
cular emphasis upon the DPS start- transient performance. The 
nominal start-transient thrust profile for DPS powered- flight 
firings is presented in Figure 23. A "mass lockout" problem can 
occur for certain off-nominal conditions, when the thrust is 
operating at a maximum value of 10,500 pounds. One of the logic 
conditions needed for mandatory secondary control mode operation 
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is that a change in throttle setting has occurred. This logic is 
applied when a change in thrust command is sufficiently large 
to satisfy the inequality. 

Tc - >525 pounds 

When is operating at a maximum value of 10,500 pounds, a mass 
of 5 percent or more will cause the primary control mode to be 
locked out. The intent of this logic was to inhibit Kalman filter 
estimates of offset acceleration when actuator-compliance effects 
were introduced by changing throttling conditions . This potential 
problem with the interface logic was corrected in the SUNDANCE 
redesign. 

The performance of the primary/secondary modes during the 
DPS start-transient period was of suffieient concern to require 
design modifications before the mission. The major problem was 
caused by errors introduced in the open'- loop drive-time equation 
and by the subsequent poor convergence characteristics of the 
primary/secondary control modes. The effect of a drive-time error 
is to maintain a residual offset disturbance torque while the 
system is in the secondary mode. If this offset be large, the 
RCS jets converge the attitude and rate errors very slowly to the 
region in which return to the GTS control is made. During this 
period, the jets must fire to combat the sustained offset dis- 
turbance. An example of this type trajectory behavior is shown 
in Figure 24. 

Factors that significantly contribute to the error in open- 
loop drive time are 

1. Propellant-fuel shift during ullage and the low 
throttling-time period 

2. Actuator mount compliance 

3. Uncertainties in the assumed values of M, L, I, 
and 6 

4. Kalman estimate of offset acceleration 

a. Insufficient measurements , 

b. Propellant-slosh dynamics 

c. Attitude-rate initial conditions 

d. Measurement noise 

Simulation testing indicated that these factors could seriously 
degrade the performance of the control system during the DPS 
start-transient period. Design modifications were made to improve 
the RCS/GTS logic interface and the quality of the Kalman estimate 
of offset acceleration. The modified interface logic is given in 
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Time , sec . 


Figure 23. - Throttle profile 



Figure 25. The interface logic shown provides significantly im- 
proved convergence characteristics at the expense of permitting 
large attitude errors during the transfer of control modes. The 
additional logic of insuring a minimum number of measurements for 
the Kalman filter was inserted because of the transient charac- 
teristic of the estimator. An actual acceleration-estimate re- 
sponse (9) is shown in Figure 26. For the simulation response 
shown, the acceleration estimate contained an error in sign for 
the first few measurements. 

Four additional design modifications were made to improve 
the DPS start-transient performance: modifying the Kalman filter 
weighting values, limiting the maximum open- loop drive time to 15 
seconds, forcing the primary control (and Kalman filter esti- 
mates) at specific times when operating in the low-throttle re- 


- 49 - 




Figure 25. - Interface logic of RCS/GTS 



gion, and modifying the GTS attitude-control law during the 26- 
second start-transient period. 

The modified GTS attitude-control law (for the start- 
transient period) is given by 
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(32) 


u = -sgn(a) 

The modified design was considered acceptable for the first un- 
manned flight, although the inherent properties of the open- loop 
gimbal drive was of concern. 

In August 1967, a decision was made to redesign the DAP; the 
SUNDANCE design, previously described, was the result of this re- 
design effort. The objectives of the redesign were to reduce 
memory-storage requirements, improve off-nominal performance, and 
reduce computer-execution time. The five major changes that re- 
sulted included elimination of the urgency-function concept, 
simplification of the jet-selection logic, simplification of the 
RCS control-law logic, improvement in the GTS/RGS interface de- 
sign, and development of an integrated state-estimator design. 


TESTING AND VERIFICATION 

The mission-verification and design testing conducted on the 
SUNDANCE DAP is discussed next. The primary objectives of pre- 
flight testing were to validate the control-system performance 
during nominal conditions, off-nominal conditions, and mission- 
related conditions. The types of simulation facilities used in- 
cluded engineering digital simulators, interpretive computer 
simulators (ICS), and hybrid simulators. 

Engineering simulators were used during initial development 
(or modification) phases to provide dynamic validation and per- 
formance evaluation of the functional design under a broad spec- 
trum of mission conditions. The ICS bit-by-bit simulator modeled 
the detailed computer characteristics, and was used to verify the 
software-programing design. Parameter-type studies associated 
with off-nominal performance are generally inefficient to run on 
the ICS. However, nominal-performance verification is conducted 
on a mission-by-mission basis. The hybrid simulators were used 
to verify hardware/software interfaces, and to provide overall 
system-performance validation. With respect to the DAP, both de- 
sign-validation and mission-veri fication testing programs were 
conducted on hybrid simulators. 

The formal testing conducted on the SUNDANCE DAP design is 
reported in references 8, 10, and 11. Reference 10 is an excellent 
test-results document. All control modes of flight were tested 
during nominal -performance conditions, RCS jet- failure conditions, 
and incorrect-mass-property conditions. Powered- flight testing 
included recovery from large rate and attitude errors, DPS/APS 
start-transient performance, and performance with large offset 
accelerations. A general summary of the test results follows. 
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Nominal performance was satisfactory (all 
modes) . 

Minimum-impulse limit cycles were achieved 
(coasting modes) . 

Efficient, automatic attitude maneuvers were 
achieved. 

Translation-acceleration capability was 
degraded by jet failures. 

Powered flight modes were relatively insen- 
sitive to inertia mismatch (errors of +25 percent 
were tolerable) . 

Several test results from reference 10 are presented to 
indicate performance trends. 

The RCS propellant consumed during a 2-degree-per-second 
maneuver is shown in Figure 27 as a function of mass mismatch. 
The theoretical fuel (1.21 pounds) is substantially below the 



1 . 

2 . 

3. 

4. 

5. 


minimum fuel usage (1.55 pounds), because the theoretical model 
does not account for jet-plume-impingement forces. A summary of 
descent-configuration maneuver performance for various jet-failed 
conditions is presented in Table XII. 

For the third condition listed, the fuel consumed was less 
than nominal. The reason for this paradox is that the jet 10 im- 
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pingement force is larger than the impingement forces associated 
with the other jets, so that overall system efficiency is higher 
if jet 10 control be deleted. 

The final performance curve shown is presented in Figure 28, 
in which the RCS propellant-versus-maneuver rate is presented for 
a LM descent configuration. The relative maneuver efficiency of 
the DAP design is difficult to assess because the theoretical 
fuel consumption used as a standard does not include the effects 
of jet plume impingement or the effects of crossproducts of 
inertia. The theoretical fuel consumption includes, however, the 
fuel required for acceleration and deceleration, the effect of 
crosscoupling torques, and the minimum- impulse fuel required to 
maintain the angular deadbands during the maneuver. 

A brief summary of the hybrid- simulation test results re- 
ported in reference 8 will be given. The control system was sub- 



Figure 28.- Theoretical and actual RCS fuel comsumption 
for LM descent configuration 
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DESCENT-GONFIGURATION MANEUVER TEST SUMMARY 
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jected to a realistic flight environment including the effects of 
RCS thruster impingement, propellant slosh, and actuator com- 
pliance. Off-nominal spacecraft environments included inertia, 
thrust, and center-of-mass uncertainties; DPS actuator-drive un- 
certainty; and RCS jet failures. The verification-run matrix 
associated with the hybrid testing was quite extensive. Inte- 
grated guidance and control hardware and a flight attitude table 
were used in the test facilities. Twenty-seven discrepancy items 
reported by the testing activity required formal disposition. 
Virtually all items requiring minor design modifications were in- 
corporated into the lunar- landing-miss ion program. 

An interesting design problem occurred in the area of in- 
ertia cross-coupling effects. With the TJET calculations estab- 
lished in the U/V-axes system, an RCS torque applied around the 
U-axis produces not only an acceleration around the desired U- 
axis, but also, in general, a coupled acceleration about the V- 
axis. The same situation applies to an RCS torque applied around 
the V-axis. The simplified equations of motion that demonstrate 
the effect of inertia crosscoupling are written as 


(33) 

(34) 

where a> = angular velocity 

My,M^ = applied torque i 

lyy, = principal moments of inertia 
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This inertia crosscoupling effect between applied U/V tor- 
ques and resulting U/V angular accelerations is significant only 
when the pitch and roll moments of inertia are substantially 
different. For powered-ascent operation, these inertia values 
were sufficient to cause crosscoupling that resulted in undesired 
limit-cycle performance. A subsequent design modification was 
made to eliminate the inertia crosscoupling effects. A non- 
orthogonal set of control axes U'/V was defined which has the 
property that a pure U torque produces no observable acceleration 
in the V direction, and a pure V torque produces no observable 
acceleration in the U' direction. This, U'/V nonorthogonal 
system can be constructed as shown in Figure 29. 
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The desired relationship between the U~ and V-axes, and the 
U- and V-axes can be obtained if the transformation angle satisfies 


Y = cos 


[I 


yy 


yy 

+ I ] 
zz 


1/2 


(35) 


The implementation of this control law where the crosscoupling 
accelerations are eliminated is described as follows. The vehi- 
cle state is estimated in the P-, Q-, R-axis system. When RCS 
control is to be applied, the Q and R components of error angle 
and rate are transformed to the U’/V system. Errors about the 
U'-axis are controlled by firing a U-axis RCS torque, and errors 
about the V'-axis are controlled by firing a V-axis RCS torque. 


FLIGHT TEST RESULTS 

The flight results discussed include test data from the un- 
manned Apollo 5 mission and the manned Apollo 9 mission. Typical 
flight-data results are presented to indicate performance trends. 
The ability to match the preflight-simulation test results closely 
with the actual flight data is dependent upon the quality of the 
telemetered data and the knowledge of the spacecraft environment. 
In general, powered-flight maneuvers and coasting-flight attitude 
maneuvers can be closely duplicated, but attitude-hold limit- 
cycle behavior is more difficult to match in the postflight 
analysis process. For the test data shown, a data-sampling fre- 
quency of one sample per second was available. 

Only the DAP coasting-flight modes were exercised on the 
Apollo 5 flight. Flight data for an automatic 5-degree-per- 
second attitude maneuver showed close agreement with simulation 
data. As reported in reference 12, the Apollo 5 mission provided 
some unplanned limit-cycle data during coasting ascent because of 
a mass-mismatch condition. This situation arose because, although 
the spacecraft was actually in an ascent configuration, the DAP 
computed the vehicle inertia to be that of the unstaged LM. As a 
consequence of the 300-percent inertia-mismatch condition, a vir- 
tually continuous -firing limit cycle resulted. The narrow- 
deadband attitude-hold logic did maintain the desired conditions, 
however. After this operation, one RCS propellant system was 
allowed to fire to depletion, and data were taken at various lower 
thrust levels as the propellant was being depleted. Almost immed- 
iately, the limit-cycle characteristics began to improve, and 
eventually the attitude-hold function settled into a minimum- 
impulse condition. 

Limit-cycle data were also analyzed during the descent-coast 
phase of the Apollo 5 mission (13) . Unexplained limit-cycle tra- 
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jectories in both pitch and roll phase planes, which were 
asymmetrical in computed error rate and symmetrical in attitude 
error, were observed. A representative trajectory is shown in 
Figure 30. During a ?-hour period, 125 jet firings oceurred, 
approximately 30 of which had durations of from 50 to 110 milli- 
seconds . 

Preflight verification testing indicated that 16-millisecond 
(minimum- impulse) firings should occur at the deadband extremities. 
An extended effort was made to match the flight-test data through 
simulation testing. Inertia coupling, aerodynamic torques, and 
diagonal firing logic were all examined, but the observed limit- 
cycle phenomenon was only partially explained. 

During another descent-coast phase, a different limit-cycle 
characteristic (Figure 31) was obtained. These trajectories con- 
tained 20-millisecond firing times, with the limit cycle restrained 
to one side of the attitude deadband. 

This trajectory condition generally occurs during sustained 
torque disturbances. Limited post-flight data prevented iden- 
tifying the exact nature of this disturbance, but a combination 
of aerodynamic torque and rate^estimation error was believed to 
have been the cause. 

The Apollo 9 mission, during which the LM was manned for the 
first time, was flown in earth orbit. All powered- and coasting- 
flight DAP modes were exercised during the mission, and the con- 
trol system performance was generally excellent. No anomalous or 
unexpected control-system conditions occurred. Data examined in 
the postflight analysis included peak-to-peak rates, attitude- 
deadband excursions, general limit-cycle characteristics (in- 
cluding existence of disturbance torques), and trim-gimbal per- 
formance . 

Several flight-data results are given to indicate general 
performance. A 2-degree-per-second maneuver response for the as- 
cent configuration is illustrated in Figure 32. A slight over- 
shoot oceurred in the and R-axes, but overall rate performance 
was satisfactory. This overshoot was caused by rate-estimator 
errors . 

A phase-plane plot of the limit-cycle performance during a 
powered ascent firing is presented in Figure 33. The intent of 
the plot is to trace the shape of the limit-cycle trajectory. 
Because of the data-sampling limitations, only discrete data 
points in the phase plane are available. The plot does indicate 
on a quantitative basis that the results are within a range con- 
sistent with preflight simulation results. 
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The final Apollo 9 flight-test results presented (Figure 34) 
is a plot of phase-plane attitude performance during a DPS in- 
sertion firing. The results indicate nominal attitude-hold per- 
formance . 


CONCLUSIONS 

The history of the design and development of a first- 
generation digital control system has been presented in this case 
Study . Because of the design flexibility inherent in digital 
systems, it is expected that increased emphasis will be placed 
upon digital control-system techniques. 

This case study has been written to define the environment 
in which control-system designer works. Reviewing the design his- 
tory, one gains an implicit perspective viewpoint of the relative 
importance of optimal control and modern control techniques. 

Some of the experience learned during development of the DAP 
may be used to avoid future design problems. Logical decision 
techniques should be applied with care in the design development, 
because conditions may exist in which these techniques may un- 
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Figure 33 . - Limit cycle during LM ascent firing 

expectedly lock out entire system functions . The use of logic 
in avoiding degraded performance has to be traded off with poten- 
tial unintended restrictions. 

Another generalization concerns the manner in which require- 
ments in the estimation function are established. Open-loop 
testing alone is not always adequate to assess the acceptability 
of the filter performance. Estimation requirements should reflect 
the manner in which the output information is used in the control 
law. As an example, a control law that is mechanized to operate 
on the sign of a function only has different requirements from a 
law that operates on both sign and magnitude. 
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Figure 34 « ™ Limit cycle during LM descent firing 

Further research effort should be expended to develop addi- 
tional analytical techniques for digital control-system design. 
Adaptive design techniques making use of the inherent flexibility 
available in digital systems should also be established. 
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